fix: enforce channel-level RBAC across WS broadcasts, REST endpoints, and frontend reactivity

Wire the bitwise permission engine end-to-end:

- Add sendToChannel() to ConnectionManager, filtering WS recipients by VIEW_CHANNEL
- Convert 6 channel-scoped events (messages, typing, reactions) from sendToServer to sendToChannel
- Add broadcastOverrideChange() to push channel_updated/channel_deleted per-user on override mutations
- Bridge legacy server_members.role TEXT to member_roles junction table on PATCH
- Add pushReadyPayload() to force re-sync frontend store after role changes
- Filter channels by VIEW_CHANNEL in GET /api/servers/:id to prevent initial load data leak
- Pre-compute viewers before CASCADE delete on channel_deleted
- Fix frontend channel event handlers to upsert/cleanup channelToServerMap and channelPermissions
- Add ChannelSettingsModal with Private Channel toggle and gear icon in ChannelSidebar

packages/web/src/api/client.ts

@@ -134,6 +134,14 @@ export const api = {
     },
     sendMessage: (channelId: string, data: CreateMessageRequest) =>
       request<MessageWithUser>('POST', `/channels/${channelId}/messages`, data),
+    getOverrides: (channelId: string) =>
+      request<{ channelId: string; targetType: string; targetId: string; allow: string; deny: string }[]>(
+        'GET', `/channels/${channelId}/overrides`
+      ),
+    putOverride: (channelId: string, data: { targetType: string; targetId: string; allow: string; deny: string }) =>
+      request<{ success: boolean }>('PUT', `/channels/${channelId}/overrides`, data),
+    deleteOverride: (channelId: string, targetType: string, targetId: string) =>
+      request<{ success: boolean }>('DELETE', `/channels/${channelId}/overrides/${targetType}/${targetId}`),
   },
 
   messages: {